preinheimer

Great post. Anyone who talks, and actually implements, client key rotation gets a +1 from me.

Far too many systems don’t have a zero downtime key rotation.

You want to use a lot of electricity? Great! We sell electricity. We will need cash in advance to handle some upgrades, rather than passing those costs on to other rate payers.

Stripe is at I. I think they’ll ipo.

Lots of endowments come with strings attached. We made a charitable donation to a local university for them to buy some specific science outreach equipment, they bought it.

This all seems reasonable to me. If you want my money or things, you’ll have to use them like I suggest.

No, they came up with some legal theory in which they’d bought the assets of some company, including the company’s ownership of some art, but not obligations like paying royalties.

I have absolutely no doubts a court would consider it impossible to transfer goods under consignment to a different entity free of the burden of the consignment contract.

Reminds me of the whole "disney must pay" debacle.

IPInfo did a report on this: https://ipinfo.io/blog/vpn-location-mismatch-report

From our side we noticed a VPN provider had a location we'd been trying to get, but had been unable to, so we started digging to find their provider. Long story short the server purportedly in some middle east country was actually 3ms away from our server in Berlin.

I mean, most “residential proxy” providers are selling access to hacked devices, or sneaky plugins

https://medium.com/@xianghangmi/resident-evil-understanding-...

Technical paper: https://ieeexplore.ieee.org/document/8835239

I discovered Terry Pratchett's books my summer in New York. I was a university student, and I'd gotten a job at eDonkey doing technical support. I lived in a crappy apartment in Brooklyn (this was circa 2004 or so), and worked near Union Square.

Quite a few days after work, or just on a weekend adventure I'd go to a bookstore a few blocks south of work and grab another Discworld book, and a slice of pizza from my favourite pizza shop labelled "Rays". I'd read some in a park, and explore.

I didn't know a lot of people in the city, filling days with Terry Pratchett was a great joy.

Heads up: there's audio. It does add something.

I think the OP is presenting themselves as the cryptographer, and the authors behind Forgejo as the amateur. At this point they've only filled one envelope but believe there is many more to find, and are hoping that in the process of tracking down this one they'll find more.

They may not advertise “getting you there at 1.2x legal speed” but the sooner they drop you off, the sooner they can get another fare. Over a whole fleet it will add up to changing the size of the required fleet.

If getting a ticket one ride in a thousand is cheaper than deploying another 2000 cars to make up for the increased trip time I’d expect them to keep getting tickets.

I’m also not sure they don’t do it on purpose. Tesla self driving has an aggressive mode willing to speed and roll through stop signs. Those were deliberate, law breaking, choices.

There’s an old cryptography story.

A cryptographer friend tells the story of an amateur who kept bothering him with the cipher he invented. The cryptographer would break the cipher, the amateur would make a change to “fix” it, and the cryptographer would break it again. This exchange went on a few times until the cryptographer became fed up. When the amateur visited him to hear what the cryptographer thought, the cryptographer put three envelopes face down on the table. “In each of these envelopes is an attack against your cipher. Take one and read it. Don’t come back until you’ve discovered the other two attacks.” The amateur was never heard from again.

https://www.schneier.com/crypto-gram/archives/1998/1015.html

We used to run some servers in a colo, we had 4u.

The problem with actually owning hardware is that you need a lot of it, and need to be prepared to manage things like upgrading firmware. You need to keep on top of the advisories for your network card, the power unit, the enterprise management card, etc. etc. If something goes wrong someone might need to drive in and plug in a keyboard.

Eventually we admitted to ourselves we didn't want those problems.

I find short form content really addictive. It’s so easy for me to lose half an hour to it, and at the end just feel like I’ve wasted my time.

Lacking better options I’ve turned on parental controls on my phone to block YouTube, and installed an extension to remove shorts from the site on my laptop.

I wish sites provided more real options.

This feels like it would run against the “I bought my device, I should control how it behaves” line of thinking.

Stripe supports 3d secure and has for years. https://stripe.com/en-ca/guides/3d-secure-2

There was a research paper several years ago showing that the "residential IP" stuff is powered by botnets and compromised devices. Luminati is specifically called out.

Paper: https://xianghang.me/files/resi_paper.pdf Medium Article: https://medium.com/@xianghangmi/resident-evil-understanding-...

I mean it’s a template, but in theory someone went and checked stuff. Did you actually have a quarterly security team meeting? Was there minutes? Was there an invite?

Did someone actually go and confirm your role based access control matrix is up to date and user accounts have the right access? Were all of those screenshots watermarked with timestamps?

There is work to do, whether or not auditors are doing it is another question.

We did SOC 2 a few years ago, I'm glad we did it.

In my mind getting a clean report required three kinds of work:

1. Work that actively improved our security posture. 2. Work that didn't change much, but made our security posture easier to understand. 3. Busy work.

I think for most companies all three kinds of work will be required, but you can also make decisions that will push the percentages around. SOC 2 required us to start doing an annual security table top exercise. You could sit down, run a scenario, run it as fast as you can, and come up with a few pre-determined "improvements" that would help if you actually had that problem in the future. Or you could sit down and really put work into it, and see what works well and what doesn't.

As an example in our last tabletop I "exfiltrated" some data from one of our servers, and challenged the team to figure out what I'd done. The easy way out would have been for someone to say "We'll look at the logs and figure it out", but instead I asked them to actually try and find it. We discovered that the sheer volume of logs for that system made them hard to work with. So we made some changes to make them easier to work with and repeated the exercise later.

It could have been busy work, but instead we got real value from it.

Looking at our SOC 2 report (we don't use Delve, our auditor isn't on their list) I don't think this is quite the smoking gun it might look like if you're not reading SOC 2 reports for a living.

There's a fair amount of boiler plate language in these reports, and a bunch of re-stating the SOC 2 controls. I'd expect two reports (same auditors, same platforms) to be nearly identical. If they're both using AWS, Github, Stripe, Vetty, they're subbing a lot of the exact same thing out to the same companies, referencing the same set of internal controls.

Reading ours. There's a section titled $Company's Controls, followed by 20 pages listing the various SOC 2 controls. e.g.

---

CC9.0 Common Criteria Related to Risk Mitigation

CC9.1 The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.

IR-01 A Security Incident Response Plan that outlines the process of identifying, prioritizing, communicating, assigning, and tracking confirmed incidents through to resolution is accessible to all relevant employees and contractors and is reviewed annually.

---

Then there's another 20 pages of those same controls being listed, some language about how they tested the controls, and hopefully "No Exceptions Noted".

That's not going to change much between companies.

What about a “right to create act” giving people the right to create things and not have their creation be ingested to train ai for billion dollar companies?

AI moderation is currently a "black box" that prioritizes safety over accuracy to an extreme degree.

I think there's a wide spread in how that's implemented. I would certainly not describe Grok as a tool that's prioritized safety at all.

You're right. I agree.

I think it’s important to test these systems. Let some % of candidates who get this wrong through to the next stage and see what happens. Does failing this test actually correlate with being a bad fit later?

If you want to ineffectivly filter out most candidates just auto-reject everything that doesn’t arrive on a timestamp ending in 1.

We really don't want to operate our own hardware. The situation in Peru at the time was that there wasn't anyone offering the bandwidth we needed who could actually back up their bandwidth claims. Forget 95th percentile, bandwidth there was straight "you pay for a pipe, we give you that size pipe (but somewhat oversold)". But no one could do more than like 5mbit that was actually more like 3.

We've got detailed global ping data here: https://wondernetwork.com/pings

One of our competitors was claiming a server in a middle eastern country we could not find any hosting in. So I figured out what that server's hostname was to do a little digging. It was >1ms away from my server in Germany.

I'm a co-founder at WonderProxy, we didn't make their list (we target people doing application testing, not consumer VPNs).

We're in 100+ countries, and I'll stand by that claim. It's a huge pain in the neck. In our early years we had a lot of problems with suppliers claiming to be in Mexico or South America who were actually just in Texas. I almost flew to Peru with a rackmount server in my luggage after weeks of problems, that plan died when we realized I'd need to figure out how to pay Peruvian income tax on the money I made in country before I could leave.

We've also had customers complaining that a given competitor had a country we'd had trouble sourcing in the Middle East. A little digging on our part and it's less than a ms away from our server in Germany.

Ive installed a browser extension to remove them on the desktop.

There should absolutely be a better answer here.

"Your data belongs to you" but we can take any of your data we can find and use it for free for ever, without crediting you, notifying you, or giving you any way of having it removed.